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Executive summary 


P rotecting a firm's reputation is the most 
important and difficult task facing senior risk 
managers, according to a new report by the 
Economist Intelligence Unit. In a survey of 269 senior 
executives responsible for managing risk, reputational 
risk emerged as the most significant threat to business 
out of a choice of 13 categories of risk. Fully 84% of 
respondents felt that risks to their company's 
reputation had increased significantly over the past 
five years. 

This report, which is sponsored by Ace, Cisco 
Systems, Deutsche Bank, IBM and KPMG, sheds light 
on the role of the risk managerin protecting corporate 
reputation. The findings are drawn from a global 
survey of senior executives, of which 36% are from 
companies in the financial services sector. 
Respondents from 18 other industries also 
participated in the survey. 

The report's main findings include the following: 

• Reputation is a prized, and highly vulnerable, 
corporate asset. Reputation is one of the most 
important corporate assets, and also one of the most 
difficult to protect, according to executives in the 
survey. In the Economist Intelligence Unit's Risk 
Barometer, a regular feature of the risk programme's 
quarterly surveys, reputational risk emerges as the 
main concern for the majority of risk managers— ahead 
of regulatory risk, human capital risk, IT network risk, 
and market risk and credit risk. This preoccupation 
with reputational risk stems primarily from the fact 
that executives now see reputation as a major source 
of competitive advantage. But changes in the business 
environment have also made companies more 


vulnerable to reputational damage, with the 
development of global media and communication 
channels, increased scrutiny from regulators and 
reduced customer loyalty cited as three issues that 
expose companies to increased reputational risk. 

• Companies struggle to categorise— let alone 
quantify— reputational risk. Risk managers are 
divided on whether reputational risk is an issue in its 
own right or simply a consequence of other risks. The 
latter view predominates where there is a tradition of 
well-structured risk measurement and management. 
In industries where risk managers feel they have 
identified the key first-tier risks facing their business, 
they may be more inclined to consider reputational 
damage as simply a failure to manage these risks 
properly. In contrast, in sectors where first-tier risk is 
less quantifiable they are more likely to see 
reputational threats as a class in their own right. 

• Compliance failures are the biggest source of 
reputational risk. The biggest threat to reputation is 
seen to be a failure to comply with regulatory or legal 
obligations. Failure to deliver minimum standards of 
service and product quality to customers is a close 
second. The risk that unethical practices in the 
organisation will be exposed follows closely behind. 
However, failure to hit financial performance targets 
scores only modestly. Both labour unrestand 
environmental breaches are also considered an 
unlikely source of reputational damage. 


2 


© The Economist Intelligence Unit 2005 


Reputation: Risk of risks 



• SMEs Lag behind on reputational risk. Bigger 
companies undertake more reputational risk 
management activities. Forinstance, four-fifths of 
respondents from organisations posting revenue in 
excess of US$10bn have implemented processes for 
crisis management, compared with just one-half for 
companies with revenue of US$lbn or below. Only half 
of SMEs formally monitor external perceptions of their 
companies, versus 61% of larger companies. 

• The CEO is the principal guardian of corporate 
reputation. The CEO is regarded as the individual with 
primary responsibility for managing reputational risk 
by most organisations in the survey. The chief 
executive is pivotal in providing an ethical identify for 
their companies. They also co-ordinate the response of 
other senior managers to reputationalthreats and 
crises. By contrast, the chief risk officer (CRO) has a 
more technical role, attempting to quantify threats to 
reputation and policing systems to make sure that 
they are properly enforced. 


• Good communication is vital to protecting 
against— and repairing— reputational damage. 

Reputation is ultimately about howyour business is 
perceived by stakeholders including customers, 
investors, regulators, the media and the wider public. 
While most companies in the survey regularly monitor 
the perceptions of their customers, communication 
with the other stakeholders tends to be more patchy. 
As a result these companies maybe slow to address 
issues that may sully the corporate image. But good 
communications becomes even more important once a 
crisis breaks. Companies that have a communications 
strategy that enables them to respond quickly and 
effectively to "bad news", and which manage issues 
promptly and openly, often emerge with their 
reputations enhanced. Those that don't often suffer 
heavy and, in some cases, irreparable damage. 
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Introduction 


T he most valuable asset in the capitalist economy 
is not cash, stock or buildings, but trust. This was 
the case in the days when banks competed with 
each other to disperse their un-backed notes among 
an ill-protected public. It is even more so today, with 
dizzying volumes of assets zinging daily through 
internationalfinancial markets fasterthan legal 
confirmation can be provided. Thus, although a 
shortage of cash can bring a company to its knees, itis 
more frequently a loss of reputation that deals the 
final blow. 

Itis curious, then, that while tools and techniques 
proliferate for managing monetary risks, the art of 
protecting reputations is poorly developed and 
understood. Most respondents to our survey agree 
that reputation is a primary asset of their 
organisation, and thatthe risks facing reputation have 
grown in recent years. However, they also 
acknowledge that reputational risk is harder to 
manage than other sorts of risk, largely because of a 
lack of established tools and techniques and confusion 
about who is responsible. 

In short, reputation is an increasingly critical asset, 
but protecting itis one of the risk manager's toughest 
jobs. Why? To start answering this central question, a 
definition of reputational risk needs to be established. 
The most popular is some form of the following: 

Reputation declines when experience of an organisation 
falls short of expectation. 

But this apparently straightforward description hides 
a wealth of subtlety. 


• Whose experience? An organisation's reputation 
resides with a wide range of interested parties. Most 
important are the customers and investors, who 
between them provide the wherewithal that allows the 
organisation to function. At a second tier, regulators 
are key, setting and enforcing standards. Employees' 
motivation feeds into productivity and service quality, 
and they are the human face of the organisation. The 
general public may be affected by the organisation's 
actions, directly orindirectly, and may respond 
unfavourably if they feel their interests to be 
prejudiced. These groups are neither mutually 
exclusive norindependentof each other. Indeed, the 
feedback mechanisms between them require special 
attention from the guardians of reputation. 

• What experience? The face that an organisation 
shows varies from stakeholder to stakeholder. 
Employees focus on pay and work conditions, and on 
the availability of training and opportunities for 
advancement. Such matters are only loosely correlated 
with the quality of service provided to customers. The 
experience of the latter may come via an 
intermediary— a retailer or business partner, for 
instance— whose own standards of delivery impinge on 
the impression formed by the customer, potentially to 
the detriment of the organisation. Investors may be 
focused more closely on shareholder value than on the 
quality of service being provided to customers, two 
factors that once again may be correlated only loosely. 
The regulator, meanwhile, may be scrutinising the 
organisation to ensure from a compliance perspective. 
In all cases, there may be a difference between what 
the organisation does and how its actions are 
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perceived. Reputations are as vulnerable to 
perceptions of failure as to failure itself. 


How significant a threat do the following risks pose to your 
company's global business operation today? 

(index score, where 100 = highest) 


• Which expectations? If a stakeholder's experience 
of the organisation falls short of expectation, it will 
downgrade its opinion. But how were these 
expectations formed? Were they unrealistic to start 
with? Did they reflect factors beyond the 
organisation's control, created perhaps by price- 
gouging competitors or by shifting social attitudes to 
matters such as environmental protection and 
equitable trading practices? Is an organisation being 
castigated because the sector in which it operates is 
under a cloud, or because it is being associated with a 
lawbreaking peer? Organisations may be punished not 
because of any failure on their part, but simply 
because they are being held to the wrong standard. 

All these considerations greatly complicate the task of 
those whose responsibility it is to build, maintain or 
repair reputations. The responses to our survey, and 
the anecdotal evidence we have gathered, suggest 
that although risk managers are aware of the threats, 
their responses vary widely from sectorto sector, and 
from firm to firm. 

Priority No 1 

Respondents to the regular Risk Barometer section in 
the survey place reputational risk clearly at the top of 
risk managers' list of priorities. With an index score of 
52, reputational risk is perceived as substantially more 
significant than regulatory risk and human capital 
risk, both of which score 41. IT network risk, which 
comes next, scores 35, while the risk management 
staples of market risk and credit risk score a modest 32 
and 29, respectively. 

The picture this paints is that regardless of how 
reputational risk is defined it stands at the forefront of 


Reputational risk (eg, events that undermine public trust in your products or brand) 
Regulatory risk (problems caused by new or existing regulations) 

Human capital risks (eg, skills shortages, succession issues, loss of key personnel) 
IT network risk (eg, network security breaches, IT systems failure) 

Market risk (risk that the market value of assets will fall) 

Credit risk (risk of bad debt) 

Country risk (problems of operating in a particular location) 

Financing risk (difficulty raising finance) 

Terrorism 

Foreign exchange risk (risk that exchange rates may worsen) 

Natural hazard risk (eg, hurricanes, earthquakes) 

Political risk (danger of a change of government) 

Crime and physical security 


Source: Economist Intelligence Unit, 2005 


business concerns. There is less agreement on how it 
should be addressed, or even whether it exists as a 
separate issue at all. The division between those 
respondents considering it a category of risk in its own 
right and those who view it as arising from a variety of 
other risks is virtually half-and-half. Nevertheless, 
most companies in the survey see reputational risk as a 
problem in need of its own, special solutions. Roughly 
three-quarters of companies disagree with the 
statement, "A well-run business doesn't need to invest 
extra resources into guarding against reputational 
risk." 

Ian Beale, risk manager at Aegis pic in London, 
focuses on reputation and on the perceptions of 
investors, clients and employees, but does not 
manage reputation as a specific risk. "We concentrate 
on the root causes," he says. "If these are managed 
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Do you view threats to your company's reputation as: 

(% respondents) 


A category of risk in its own 
right 52 

Something that arises as a 
consequence of a variety of 
other risks 48 



Source: Economist Intelligence Unit, 2005 


well, then hopefully our reputation stays where we like 
it." Aegis is a media group, whose companies are 
engaged in everything from traditional media to 
Internet and billboards, as well as media research. 

Mr Beale finds it a "struggle" to think of what 
additional actions could betaken that are not already 
covered by good overall risk management. However, 
he emphasises that Aegis does spend time and energy 
making sure that the perception ofthe company is 


good. "We carefully consider who says what," he says, 
and thought is given to the potential impact of actions 
on clients and employees. Since other executives 
describe these activities as the fundamentals of 
reputational risk management, it appears that much of 
the confusion here arises simply from definitions. 

Doug Gafner, director of risk management at Hilton 
Hotels, considers reputational risk to be "more about 
getting everything else right" than a unique issue. 
Hilton, for example, does not buy brand risk 
insurance, even though it is one of most trusted 
brands in the US. 

At the other extreme comes Dr Guruswami 
Raghavan, professor of finance at the SDM Institute 
for Management Developmentin Mysore, India. 
"Reputational risk is the starting point for all risk," he 
explains. "If you have no reputation, you have no 
business." 

Reputation is notjusta question of how an 
organisation is perceived, but of how it is perceived 
relative to peers and competitors. For the world's only 
widget supplier, quality may have little bearing on 


Regulation meets 
reputation 


Our survey respondents are more or less 
unanimous in considering that reputa- 
tional risk has risen sharply in recent 
years. 

The reasons are many. High-profile 
market failures such as those that 
brought down Enron and WorldCom are 
part of the story. "Regulators are 
regulating more", says Mr Damasceno at 
ABN AMRO, pointing to the increasingly 


intrusive role of those charged with 
policing the proper functioning ofthe 
market economy. "The intentions are 
good: it is an attempt to exorcise the 
decline of corporate values and to 
improve the publictrustin corporate 
business and the market economy." 

But has the pendulum swung too far? 
For Mr Mander of Bank of Ireland 
Securities Services, the answer is an 
emphatic "yes". The unforgiving focus on 
failures to meet standards is forcing 
organisations to dedicate valuable 
resources to protecting reputation, 
rather than on establishing relationships 
with clients and customers that are 


sufficiently flexible to overcome 
occasional shortfalls in service. "The 
marketplace will eventually realise that 
over-emphasis on individual risk issues is 
an inefficient way of dealing with them, 
and place more emphasis on bilateral 
relationships," he says. 

He blames over-zealous regulators. "A 
lot of what we're doing is driven by 
regulatory requirements rather than best 
practice," he explains. However, he 
acknowledges that with new measures 
such as the Basel II revised international 
capita l framework stillin the pipeline, it 
will be some time before the pendulum 
reverses its swing. 
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sales. However, such reputation-proof corners of the 
market exist only in text books. Thus, maintaining 
reputation is as much a matter of competitive position 
as it is of individual standing. 

Our survey clearly reflects this competitive 
environment. Respondents identify the growing role 
of reputation as a source of competitive advantage as 
the factor most likely to focus management attention 
on reputational risk. The development of global 
media/communication channels as a disseminator of 
reputationally sensitive information is rated second. 
The regulator comes next, with the imposition of 
higher standards of governance in the wake of the 
high-profile market failures ofthe past decade. 
Customer power— their readiness to switch supplier — 
is fourth in the list, ahead of governments' greater 
propensity to intervene in defence ofthe public 
interest. 

"It's a buyers' market," says Derek Mander, head of 
finance & risk management for Bank of Ireland 
Securities Services. "In the past, if we failed to meet 
our service standards, we would sit down with clients 
and reach a solution. Now, clients are more likely 
simply to change service provider." 

Secondary hit 

Individual types of risk may hit certain business 
divisions or operations, but each has the potential to 
cause secondary damage to reputation— and this can 
easily prove more damaging to profits and shareholder 
value in the long run. 

FaiLure properly to control credit risk will result in 
defaults, which will bear a financial cost and deplete 
capital. However, the perception that an organisation 
is unable to manage such risks can plant doubt in the 
minds of its partners, clients and regulators, diverting 
potential business elsewhere and eliciting a more 
intrusive and more costly regulatory stance. In the 


How large an impact is each ofthe following factors likely to 
have in prompting an increased focus on reputational risk 
within your company? 

(% respondents, large impact, index score, where 100 = highest) 


Reputation is becoming a key source of competitive advantage as products/ 
services become less differentiated 

Faster dissemination of 'bad news' through global media/ 
communication channels 

Higher standards of governance imposed by regulators 

Customers readier and more able to switch suppliers than ever 

Increased willingness of governments to intervene in business on issues 
of public concern 

Customers' increased focus on buying from ethical suppliers 
Increased targeting of companies by pressure groups 


Source: Economist Intelligence Unit, 2005 


extreme, such doubts can fuel a self-fulfilling fear 
among depositors that their assets are not secure, 
sparking bank runs that can quickly wipe out 
institutions. 

The potential of relatively minor failures of risk 
contralto rebound on reputation means that, at the 
very least, risk managers must be aware of how an 
event might damage the company's image. But these 
issues may also require a specific response. Many kinds 
of risk, in addition to the narrow threat they pose to 
the business operation, have a reputational element 
that must be managed separately, whether by 
managing stakeholder expectations via corporate 
communications or by establishing processes for 
quickly addressing crises when they arise. 

In some areas, the reputational aspect of a specific 
risk can be the predominant threat, and recognising 
this may call for a tougher response than might 
otherwise have been adopted. Forinstance, when 
selecting business partners or, in the case of a bank, 
major depositors, due diligence should weed out those 
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whose financial backgrounds suggest an unacceptable 
likelihood of business interruption or default. But it 
may also uncover unsavoury facts about the potential 
partner, which, although not reflecting directly on 
their financial health, reveal a character with which 
the organisation may prefer not to be associated. 

The business of choosing your trades is familiar to 
Nedia Miller, owner and founder of Miller CTA, a 
commodities trading adviser specialising in "crude oil 
and all the products". In designing hedging strategies 
for major clients there is broad scope for unethical 
behaviour. "I've given up large clients rather than 
cross the line and risk my reputation," she says. "The 
financialcost [of legal sanction] is high, but the 
opportunity cost [of losing business because of a bad 
reputation] is even higher." In this context, Ms Miller 
believes in the importance of personal ethics in 
protecting a firm's reputation. New rules and guidance 
introduced since Enron's collapse may help in the 
short run, "but unless there are ethics, it won't work 
for long". 


The relationship with stakeholders is in itself a 
potential source of business failure. This is 
reputational risk pure and simple, and managing it 
implies both an awareness of how stakeholders feel 
about the organisation and a capacity to respond 
when the feedbackis bad. Judy Larkin, directorand 
co-founder of Regester Larkin, a consultancy 
specialising in reputational risk, emphasises this 
aspect. With a "more intrusive media organisations 
must focus resources and time" on monitoring their 
environment. 

In short, black-and-white descriptions of 
reputational risk as either discrete or dependent miss 
the point. In general, reputational risks can be viewed 
as independents their effect on the organisation, but 
dependents that reputational damage usually 
reflects a failure to deliver products and services as 
promised. There is also scope for managing reputation 
as a separate facet of the organisation, by surveying 
stakeholder opinion and adjusting the corporate 
message to address shortfalls. 


Ethical business 


Two fairly recent developments in the 
business environment, customer demand 
for ethical products and the rising influ- 
ence of pressure groups, came atthe end 
of the list, butin both cases are thought 
to exercise a high impact by at least one- 
quarter of respondents. The latter may 
be of some encouragement to a couple of 
groups whose activity revolves around 
the growing importance of reputation: 


the ethical investment market and the 
NGOs seeking to enforce ethical gover- 
nance. 

Among the former is Wayne Hawkins, a 
board member of Hunter Hall, a 
pioneering ethicalinvestmentfirm based 
in Australia. His main interestisin 
safeguarding the company's own good 
name. "An ethicalfund manager lives or 
dies by their reputation," he says. 

For pressure groups, the challenge is 
to put the values of specialised funds 
such as Hunter Hall's into general 
practice. The point is made by Craig 
Bennett, head of the Corporate 


Accountability Campaign at Friends of the 
Earth, a UK pressure group. "The 
potential of socially responsible 
investment is probably overdone. It is 
more interesting to see how mainstream 
investing is getting more responsible," 
he maintains. In this, he believes the 
trends are firmly in favour of the activists. 
For instance, he identifies a growing 
realisation that more environmental 
regulation and legal obligation is on the 
way. "It is a train that is coming." 
Companies that are ahead of the trend, 
the "forward thinkers", will be the 
beneficiaries. 
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School for scandal 


A decade ago, faced with a financial 
squeeze thatthreatened its survival, Car- 
leton University in Ottawa picked a strat- 
egy designed fora quick increase in 
enrolments, the main pillar of which was 
to lower entry requirements. It was not 
subtle: "We took students that probably 
would not have made it into other uni- 
versities," says Tony Lackey, manager, 
risk and insurance. The institution picked 
up the nickname, "Last-chance U". 

Enrolments responded, and funding, a 
function of student numbers, rose 
accordingly. But problems quickly 


emerged. Although first-year lectures 
were stuffed, attendance soon dropped 
off. The financial problems persisted, and 
now the University was saddled with an 
unenviable reputation into the bargain. 

The first challenge was one of 
recognition: "We asked students why 
they weren't coming to Carleton," writes 
Mr Lackey. It quickly became obvious that 
the institution's poor reputation was 
putting off the better candidates. 

Once the reputational problem had 
been added to the risk matrix— it 
immediately rose to the top of the list in 
the annual report prepared for senior 
management— the remedies were more 
straightforward. "We raised entry levels 
and worked to turn ourselves into a 


research-intensive institution. We 
concentrated on attracting more funding 
and higher-level faculty," Mr Lackey says. 
Thestudents that did make itin were 
better treated. Student services— 
everything from food to buildings— was 
revamped. 

The University is now clawing its way 
back up the national rankings— and 
reputational risk has fallen from first 
place to third on the annual risk report. 

The Carleton case is a study in what 
happens when the reputational aspects 
of a strategic decision are not properly 
understood. "We were in financialtrouble 
and we went downmarket," explains Mr 
Lackey. "Nobody had tied the 
reputational impact into funding." 


The cost of reputation 

Whether organisations are altogether comfortable 
with modern definitions of reputational risk, there is 
little doubtaboutthe potential costs offailure to get 
to grips with it. Companies found reputational 
problems to be the most costlyin financialterms, 
relative to a series of other risks. Among those who 
had faced reputational problems, 28% described the 
financial tolL as major. Loss of key skills and talent, the 
next most severe problem, caused a major financial hit 
for only 18% of those affected (although it is worth 
noting that 52% identified this as a source of minor 
losses, making it the leading cause of financial losses 
among the sample overall). 

The results reflect the mannerin which damage to 
reputation can be more costly than the directimpact 
of the events that caused it. "The conventional areas 
of risk are like the visible part of an iceberg," says Dr 


Raghavan. "Reputational risk is the larger part below 
the surface." 

On the other side of the coin, those looking for 
investors are likely to find good reputation a key factor 
in attracting suitors. "Confident investors will pay a 
higher price for a piece of the action," says Jonathan 
Clare, chief executive at Citigate Dewe Rogerson, a 
London-based public relations company specialising in 
financialand corporate communications. "If companies 
get their PR right, it will reduce the cost of capital." 

Once again, there are some interesting sectoral 
variations in the survey. Although financial services 
and energy sector responses closely mirror the general 
pattern, others differ from it substantially. For 
instance, more than one-third of government/public- 
sector respondents identified loss of key skills and 
personnelas having resultedin major financial losses 
(and a similar number as having caused minor losses). 
Among this group, reputational damage had been the 
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How much damage have the following events inflicted on your company's financial performance in the past? 

(% respondents) 


Loss of reputation 


Loss of key skills and talent 
Employee fraud 


Loss/theft of intellectual property 


IT failures or electronic security breaches 


Damage to physicalinfrastructure 


Non/negligible 

mamma 


EH 

E3 


i a 

EH 

EM 


result of major losses for only one-tenth. Since there is 
little reason to suppose that public organisations incur 
less reputational risk than private ones, the 
implication is that they are less susceptible to 
reputational damage. In professional services, 
reputational damage is the biggest single cause of 
major financial loss, but loss of key skills and 
personnel runs it a far closer second than in the 
generalsample. 

Danger points 

For most risk managers, it is the failure to comply with 
regulatory or legal obligations that represents the 
biggest threatto reputation. This is supported by the 
relatively prominent position of the regulator as a 
driver of board-level focus on reputational risk, 
indicated above. Second on the list of potential 
sources of reputational damage is failure to deliver 
minimum standards of service and product quality to 
customers— although the gap is small. The risk that 
unethical practices in the organisation will be exposed 
is placed third, once again by a narrow margin. 

Security breaches figure quite prominently, as do 
failures of crisis management and risk by association 


with third parties. 

Failure to hit financial performance targets scores 
only modestly. Given the importance of investors 
among organisations' stakeholders, and the focus in 
modern investing on shareholder value, the relatively 
lowly position of meeting market expectations appears 
odd. It may reflect the fact that organisations perceive 
this to be a financial risk rather than a reputational 
one, although modern risk management theory would 
suggest that they should consider the reputational 
facet of financial performance more seriously. 

The anecdotal evidence is that many do, and that 
share price is perceived as a key way of gauging the 
value of reputation. Mr Mander of Bank of Ireland 
Securities Services points out that the bankis 
particularly vulnerable to anything that depresses the 
share price. It has escaped the consolidation of the 
sector so far, but a reputational crisis would leave it 
"wide open to takeover". 

At the lower end of the scale, it is more interesting 
to look at the weight of respondents identifying 
reputational impact as minor. This suggests that, in 
general, both labour unrestand environmental 
breaches are considered unlikely sources of 
reputational damage. 
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The List of priorities changes when results for the 
financial sector are separated out from the rest. 
Regulatory and legal non-compliance receive 
particular emphasis from financial organisations, 
presumably reflecting both the intensity of sectoral 
regulation relative to other industries and the key role 
that legal compliance plays in popular perception of 
banks, pension funds, insurance companies and the 
like. Standards of service sinkto fourth place for this 
sector, below both exposure of ethical practices and 
security breaches— again, public trustin honest 
service appears to be the key, rather than public 
perception of the quality of that service. 

In contrast, those in other sectors place the risk of 
failing to deliver minimum standards of service and 
product quality to customers as the principal threat to 
their reputations. Failure to comply with laws or 
regulations is a rather distant second, closely followed 
by the exposure of unethical practices. Towards the 
bottom of the list, non-financial sector respondents 
score environmental breaches as a minorthreatto 
reputation— but, as would be expected, give it more 
emphasis than financial sector respondents. 

Do these conclusions support the proposition that 
reputational risk managementis an issue distinct from 
simply ensuring that the first-tier risks are properly 
covered? Only to a point. Although first-tier riskissues 
predominate in the list, a couple with a more direct 
impact on reputation are prominent among managers' 
concerns. On the one hand, theimportance of being 
perceived as ethical, in particular, is arguably more a 
reputational issue than one of fundamental risk 
management. On the other, one of the issues most 
closely associated in the public mind with reputational 
standing, being seen to address issues of public 
concern such as climate change, is relegated to the 
bottom ofthe list of priorities. 


Crisis management or 
crisis prevention? 

Reputation is a dynamic asset, changing as 
organisations present new services and products in new 
markets, being held to changing criteria and facing 
unforeseen challenges. This suggests that there is a role 
for risk managers both in maintaining and protecting 
the organisation's standing with its stakeholders, and 
in repairing its good name when events conspire to 
damage it (see box: Howto manage a crisis). 

It is the latter that receives most attention from risk 
managers, with 64% of respondents saying they plan 
and document processes for crisis management. 
However, monitoring perceptions also figures 
prominently, with 53% reporting that external 


To what extent are the following actions a source of reputational 
risk for your organisation? 

(% respondents) 


Majo 


Non-compliance with regulation/Legal obligations 


Exposure of unethical practices 


Security breaches (eg, sensitive data leaks, hacking of customer financial data) 
Failure to deliver minimum standards of service and product quality to customers 


Poor crisis management 


WSM 


Risk by association with suppliers, partners, alliances, etc with poor reputations 


Failure to hit financial performance targets 


Failure to address issues of public concern pro-actively (eg, climate change) 
Environmental breaches 


Labour unrest 


Source: Economist Intelligence Unit, 2005 
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Howto manage 
a crisis 

What should a company do when faced 
with bad news that could hurt its reputa- 
tion? 

If a crisis has already broken, there is 
not much room for manoeuvre. First, 
according to Ms Larkin of Regester 
Larkin, the company needs to "fix the 
problem" that caused the reputational 
issue. At the same time, it needs to 
"communicate very quickly". This 
communication must have three 
elements, orthree"C"s: 

1. Concern— the company has to 
acknowledge that something has gone 
wrong and express regret and concern. 

2. Commitment— it must express a 


commitmenttofixthe problem, and lay 
outin detailwhatitwilldo. 

3. Control— if the company is at the 
centre of a major crisis, the leading 
figures in the company need to show that 
they are in control of the situation and 
are working with any relevant authorities 
to ensure it won't happen again. 

Companies "have limited time" to start 
this communication, otherwise other 
organisations will assert their own 
agendas. If they can communicate 
quickly, those running the business may 
get stakeholders to give them the benefit 
of the doubt and have time to do 
something about the problem. 

"If the reality is bad, it's essentially a 
matter of making people important to the 
company understand the issue, and to 
demonstrate that the company is 
listening", says Jonathan Clare of 


Citigate Dewe Rogerson. "Then you have 
to convince customers and investors that 
you have a solution to the problem." 

Mr Jackson of Fordham University 
summarises it thus: "Be humble, disclose, 
apologise, resolve to change things, be 
systematic." He advises above all against 
treating the problem as a cosmetic issue, 
which people willimmediately see 
through. He warns that "[superficial 
change] makes people even more angry". 

Ragnar Lofstedt, professor of risk 
management at Kings College London, 
takes a more strategic approach. "The 
response depends on the nature of the 
threat," he says. "You need tojudge how 
much trust the public has in you and in 
your attacker." If you are trusted more, 
he suggests, fight back. He believes that 
levels oftrustare the key, ratherthan the 
details of the case. 


perceptions of the company are regularly measured. 
Once again, in the vein of preparation and early 
warning, 50% train their employees to identify and 
manage reputational risks (a low number, considering 
the prominence all respondents give to the issue) and 
47% systematically track reputational threats. 

The most revealing splitin these responses is 
according to the size of the organisation. Not 
surprisingly, there is a general trend for those with 
more revenue to undertake a greater number of these 
activities: 80% of respondents from organisations 
posting revenue in excess of US$10bn have 
implemented processes for crisis management, 
compared with just 53%forsub-US$lbn companies 
(although in both cases this is the most widely 
employed strategy). 

Monitoring outside perceptions of the organisation 


appears to be something of a luxury, with 61% of the 
bigger organisations carrying this out, compared with 
51% of the smaller organisations. GE Healthcare is one 
such company, large in its own right but also a 
subsidiary of a true global giant. This is reflected in the 
breadth of its efforts to monitor and manage 
stakeholder perceptions. "We monitor how the 
organisation is perceived with stakeholders, we lobby, 
we establish relationships with the media, and we 
advertise our philanthropic efforts," reports Steven 
Kay, the company's process and crisis manager. 

The company's diversity and size give it an 
important role in major disasters such as the 
hurricanes that hit the US Gulf coast and the Asian 
tsunami. The diversified group can supply a range of 
vital supplies and services, such as fresh water, power 
and medical equipment. These are opportunities for 
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the company to be seen in the best light, but these 
operations must be undertaken carefully, since they 
could be construed as exploiting misfortune to gain 
business advantage— having the opposite reputational 
effect to that desi red. 

This focus on perception is where many companies 
fall down, according to Ms Larkin. "Perception is the 
biggest threat to reputation today," she says. She says 
that you can be doing everything right, but if people 
don't think you are you still have a problem. Ms Larkin 
is "surprised that some [business] sectors still don't 
acknowledge the impact of public perception", and 
therefore pay insufficient attention to reputational 


risk management. 

Another big international firm with a sharp 
reputational focus is Hilton Hotels, where according to 
Mr Gafner "everyone is thought to have something to 
do with reputational risk", and that responsibility for 
protecting the firm's good name runs from the CEO 
down. 

However, even among the largest firms the 
intangible nature of reputation and the factors that 
affect it mean that risk can never be fully mitigated. As 
Kevin Jackson, professor of business ethics at New 
York's Fordham University, puts it: "You are never 
going to be able to please everybody." Mr Jackson, 


Which of the following activities does your organisation take to manage reputational risk? 

Please check all that apply. M More than US$10bn revenues 

(% respondents) Less than USJlObn revenues 

Less than US$lbn revenues 


Processes for crisis managementare planned and documented 



The risk function's remit now covers key reputational threats and challenges 



Standards on environmental, human rights and labour practices are set publically 


(8) 22 


Relationships and trust with pressure groups and other potential critics of your firm are established 



Source: Economist Intelligence Unit, 2005 
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author of a book, Building Reputational Capital, points 
to the example of HB Fuller, a large US-based 
manufacturer of adhesives and other chemicals. The 
company worked hard to build a reputation for 
corporate responsibility, but nevertheless took a big 
hit a decade ago for not seeming to do enough about 
glue sniffing in Latin America. 

Among smaller firms, no strategy is pursued by 
substantially more than one-half of respondents, 
while, among the larger, only three are carried out by 
less than one-half. 

A typical example of a firm seeking out a strategy 
for managing reputational risk is Gulf Finance House 
BSC, based in Bahrain, that offers Islamically 
structured financial services for regional investors. 

The bank did not have a risk management strategy at 
all until 18 months ago, when it appointed Silvan 
Varghese as head of risk management. Atthetime, 
protecting the bank's reputation was considered a 
matterforthe communications function. Mr 
Varghese's team is now looking at managing such risks 
more systematically. 

A consultant is being taken on to benchmark the 
current risk status. "We're identifying where we stand 
with stakeholders, including banks, regulators, 
customers and shareholders," says Mr Varghese. "Then 
we'll assess howto address areas of weakness, and 
how to manage a crisis should it arise." 

Mr Varghese takes a crumb of comfort from the 
knowledge that he is not alone in his quest for a 
reputational risk management strategy. "We all feel 
more comfortable with tangible risks that we can 
count," he says. 

Interestingly, in light of popular perceptions ofthe 
modern risk environment, companies of all sizes agree 
in the low priority they give to buzz issues such as 
establishing relationships with pressure groups and 
setting out public standards on environmental, human 
rights and labour practices. In both cases, these 


strategies appear at the bottom ofthe list, attracting 
one-quarter of respondents or fewer— an observation 
that would come as no surprise to Mr Bennett at 
Friends ofthe Earth. 

Matter of opinion 

When it comes to reputation, all opinions matter, but 
do some matter more than others? Our survey suggests 
strongly that they do. 

Of all respondents, 60% test the perceptions of 
customers at least quarterly, and 40% say they do so 
continuously. Only 4% say that they have never taken 
the pulse of customer opinion. Regulators' views are 
also sought relatively frequently— at least quarterly by 
51%, although only 23% say they continuously survey 
regulator opinion. The influence ofthe media on 
organisations' reputation is also recognised, with 58% 
saying they test opinion among this group at least 
once a year. 

Beyond these groups, there is more grist for Mr 
Bennett's mill. Political activists are ignored by 46% in 
our sample, although 32% consult them at least once 
a year. Local and international NGOs are also 
sidelined, ignored by 32% and 42%, respectively. 

Once again, however, a substantial minority do seek 
out their opinion on a regular basis. 

Again, sectoral splits reveal some interesting 
variations. Customer opinion is generally given the 
highest priority, but this is not the casein the energy 
sector, where the powerful influence of regulators sets 
a premium on their views ofthe organisation. In this 
group, 45% continuously monitor regulator opinion, 
and a further 35% do so at least once a year. Customers 
and government are next on the list, but political 
activists and NGOs are consulted rarely, if at all. 

In the financial sector, customers and the regulator 
are polled systematically— at least once a year by 80% 
in the case of the former and by 75% in the case ofthe 
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latter. But the frequency of monitoring varies sharply, 
with customers courted more assiduously; 45% of 
respondents say they monitor customer opinion 
constantly, but only 26% monitorthe opinion ofthe 
regulator. 

Who's in charge? 

If reputational risk lies somewhat apart from 
quantifiable first-tier risks such as credit risk, market 
risk and network risk, is there a danger that it is 
disregarded, and whosejobisitto ensure that that 
does not happen? Asked to locate responsibility for 
managing reputational risk, respondents give a clear 
picture ofthe hierarchy. 

At the top ofthe reputational risk team is the CEO, 
cited by 84% of respondents as the person with 
primary ownership of this area. Companies appearto 
believe that only the chief executive can take ultimate 
responsibility for ensuring that all parties are working 
in unison to protect reputation and manage crises. The 
CEO is also charged with sensing external perceptions 


ofthe organisation, a role backed up by the 
communications function. Interviewees also 
emphasised the importance ofthe CEO's role in setting 
the right tone and standards of conduct to protect and 
enhance the company's reputation. 

Responsibility is also shared more broadly among 
the board of directors as a whole, but only by 42% of 
respondents. Only 39% of respondents identify the 
CRO or head of risk management as bearing major 
responsibility. Significantly, the heads of business 
units are given equal weighting. In contrast to the 
CEO's role, the CRO's chief area of responsibility is a 
more technical one, focused on attempting to quantify 
threats to reputation and policing systems to make 
sure they are properly enforced. This is an obvious 
enough division of labour according to expertise. As 
Ken Akoundi, senior vice-president for risk 
management (CRO) at Optima Managements New 
York, puts it, "A lot of these senior people do this more 
based on years of experience than on a modelor 
framework. My job is about creating the framework." 

So far, the division of responsibility suggests a 


How often do you test perceptions of your company among the following corporate stakeholders? 

(% respondents) 


Continuously 


Regulators 


Media groups 
Government 
Local non-governmental organisations 
Political activists/pressure groups 


International non-governmental organisations 
Source: Economist Intelligence Unit, 2005 


At lea sto n ce At lea st f o u r 

a month times a year 


Once a year Only occasionally Never 
in the past 


m 

ej 

m 
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strategy that is directed towards the organisation's 
own operations. But what about managing outside 
perceptions and dealing with stakeholders? The 
appearance of the communications manager at fifth 
place on the list, picked out by 35% of respondents, 
suggests that this angle is not the primary focus for 
most organisations. 

These effects are particularly marked when 
organisations are split by income. Those with revenue 
of US$lbn or below and US$10bn or above share 
similar hierarchies (although the latter give a greater 
role to the CFO), but the selection among higher 
earners of multiple options is far more widespread. 

This implies, as to be expected, that bigger companies 
spread responsibility for reputational risk more widely, 
and more extensively at lower levels of seniority, than 
the smaller companies. 

While the role of standard-bearer for the brand 
belongs to the CEO and the board, many risk managers 
emphasise the importance that all staff members are 
aware oftheir part, and play it fully. According to Artur 
Damasceno, vice-president of audit at ABN AMRO, 
"[reducing reputational risk] starts with your personal 
example as an employee and a citizen." "Everybody 
should be involved [in protecting reputation], 
otherwise it would not be sustainable." 

The CEO's role in leading this "reputationalteam" 
seems pivotal, but some companies reveal doubts 
about whether anyone is investing sufficient time and 
resources into reputational risk management in 
practice. One response in the survey that is 
particularly revealing is the high level of concern 
expressed by executives about the fact that no one has 
taken formal responsibility for reputational risk. This 
is considered a major obstacle to effective risk 
management by 39% of respondents, making it one of 
the biggest barriers to managing reputational risk 
successfully. It suggests that satisfaction with the 
current allocation of responsibility is nothigh. 


Room for improvement 

The lack of consensus regarding reputational risk 
management strategies and the shortage of 
established tools for thejob are reflected in the patchy 
levels of satisfaction expressed by risk managersin 
their efforts in this area. More than 60% appear happy 
with their communications with customers, and this 
matches the priority given above to monitoring 
customer opinion. A further 33% consider their 
capabilities in this area to be adeguate, and only 7% 
class them as poor. When it comes to communicating 
with other stakeholders, the level of satisfaction is 
markedly lower: 48% declare good capability, 38% 
adeguate and 13% poor. This implies that the lower 
freguency with which opinion is monitored among 
these groups, as indicated above, is not through lack 


Which of the following have major responsibility for managing 
reputational risk within your company? 

Please check as many as apply. 

(% respondents) 


CEO/President/Chairman 


e a 


Board of directors 


E3 


Chief risk officer (CR0)/Head of risk management 
Head of business units 


Communications manager 


E3 

ED 


Compliance officer 

Chief operating officer 

Marketing manager 

Head of country operations 

Brand manager 

Media agency 

Other 

■i 

Source: Economist Intelligence Unit, 2005 
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of desire among risk managers. 

Substantial confidence is expressed in 
organisations' ability to enforce strong controls on 
governance and compliance. However, when it comes 
to monitoring threats to reputation, only 51% 
describe their capabilities as good, while 34% describe 
them as adequate and 15% as poor— more than for any 
other area. 

The difficulty of controlling risks to reputation 
arising from third-party partnerships is reflected in 
the relatively low level of satisfaction expressed with 
capabilities to ensure ethical practices throughout the 
supply chain. This is a particularly elusive area of risk 
management. Damage to the reputation of a business 
partner, adviser or auditor can be transferred to the 
organisation by simple association, and is less easily 
repaired than the cost of an unpaid bill or an unmet 
contract. "If their reputation is good, mine is probably 
good too," says Dr Raghavan. 

The lowest level of confidence, despite the 
emphasis given to itin other questions, concerns the 
capability to manage crises. Here, those judging their 
position as good (40%) are outweighed by those with 
only adequate preparations (45%). 

Opinion is divided over whether reputational risk 


can be quantified. Just over one-half of respondents 
believe it can, compared with one-quarter who think it 
cannot. It would be reasonable to expect that those 
most confident in their ability to express reputational 
risk in numbers would be from industries such as 
finance, where a quantitative approach to risk 
management is well established. In fact, this is not the 
case. In financial services, 30% consider reputational 
risk unquantifiable, a larger percentage than in the 
overall sample. In contrast, within the energy sector 
two-thirds felt they could quantify reputational 
threats. Only one in ten said they could not. 

Practice suggests that, although methodologies for 
quantifying reputational risk have been put forward, 
none has won general acceptance. Methods centre on 
business managers estimating the losses that would 
occurin the event of a service failure that rebounded 
on reputation, normally by ranking them on a simple 
numerical scale. The results can be consolidated and 
used as a guide to the allocation of resources. The 
principle appears sound, but is dogged by difficulties, 
such as the lack of a database of reputational losses 
against which judgments can be benchmarked and the 
difficulty of separating direct losses from the less 
foreseeable indirect ones (a regulatory sanction is 


How would you rate your company's capabilities in the following areas? 

(% respondents) 

Communicating with customers 

Enforcing strong controls on governance and compliance 
Monitoring threats to reputation 


m 


Ensuring ethical practices throughout the supply chain 
Communicating with external stakeholders (otherthan customers) 
Crisis management 


m 


m 


EJ 


Source: Economist Intelligence Unit, 2005 
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finite; the reputationalfalloutis not). Mr Jackson of 
Fordham University suspects that reputational risk 
cannot be measured, and denounces "a faction of 
empirically minded researchers who want to make it 
[reputational risk] as scientific as possible". Even so, 
many risk managers are attempting to at least 
prioritise, if not precisely quantify, the various threats 
against their companies reputations. 

Conclusion 

Opinion is divided as to whether reputational risk is a 
category of risk in its own right, or merely the 
consequence of a failure to manage first-tier risks. 
Whatever position companies take on this, almost all 
executives agree that corporate reputation is a hugely 
valuable asset that needs to be protected. It is also 
clear that serious reputational damage can occur 
simply as a result of perceived failures, even if those 
perceptions are not grounded in fact. Understanding 
how different aspects of an organisation's activities 
impinge on stakeholder perceptions is therefore a vital 
aspect of protecting a company's reputation. 

There are three distinct tasks to managing 
reputational risk: establishing reputation to begin 
with, maintaining it through the rough and tumble of 
business operations, and restoring it when it has been 
damaged. The latter two, especially, call for very 
different actions (and actors). Whereas establishing 
and maintaining reputation may be considered a 
matter of successful risk controlin other areas, 
reputational repair clearly cannot. 

Reputational risk can arise from almost any 


business failure. As such, it is too important and wide- 
ranging to belong to any individual or department. 

The CEO plays the vital co-ordinating role, but must 
also personify the values and conduct that ensure a 
company's good standing. Other members of the 
reputational risk team include the chief risk officer, 
who tends to be more focused on the more technical 
task of monitoring, mitigating and, where possible, 
quantifying reputational threats. Communications, 
service and sales staff are involved in mitigating the 
reputational fallout of everything from a negative 
news story to a break down in customer service. Above 
all, good companies create a culture where employees 
take responsibility for enhancing corporate reputation 
through their everyday activities. Responsibility for 
corporate reputation, and the threats that can 
undermine it, extend from top to bottom in today's 
organisations. 

Currently, many companies feel that their 
capabilities in managing reputational risk leave much 
room forimprovement, but the high rewards of success 
should provide strong motivation for progress in this 
area. Incurring reputational damage can be fatal, but 
establishing a robust reputation can provide a strong 
competitive advantage. A good reputation strengthens 
market position, reduces the price of capital and 
increases shareholder value. Itinsulates the brand, 
permits higher prices and helps to attract top talent. It 
protects public companies from unwelcome takeover 
bids, arms them for M&A forays of their own, and raises 
the potential returns from share offerings. In times 
when the issue of trust is under particular scrutiny, 
these are prizes well worth attaining. 
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About the survey 

A total of 269 senior risk managers participated in our 
survey on risk and reputation. The survey was 
conducted in October 2005, and ourthanks are due to 
all those who shared their time and insights. 


How significant a threat do the following risks pose to your 
company's global business operation today? 

(% respondents, index score, where 100 = highest) 

Reputational risk (eg, events that undermine public trust in your products or brand) 
Regulatory risk (problems caused by new or existing regulations) 

Human capital risks (eg, skills shortages, succession issues, loss of key personnel) 
IT network risk (eg, network security breaches, IT systems failure) 

Market risk (risk that the market value of assets will fall) 

Credit risk (risk of bad debt) 

Country risk (problems of operating in a particular location) 

Financing risk (difficulty raising finance) 

Terrorism 

Foreign exchange risk (risk that exchange rates may worsen) 

Natural hazard risk (eg, hurricanes, earthquakes) 

Political risk (danger of a change of government) 

Crime and physical security 


Do you view threats to your company's reputation as: 

(% respondents) 


A category of risk in its own 
right 52 

Something that arises as a 
consequence of a variety of 
other risks 48 



How large an impact is each of the following factors likely to 
have in prompting an increased focus on reputational risk 
within your company? 

(% respondents, large impact, index score, where 100 = highest) 


Reputation is becoming a key source of competitive advantage as products/ 
services become less differentiated 

^ 1 

Faster dissemination of 'bad news' through global media/ 
communication channels 

Higher standards of governance imposed by regulators 

Customers readier and more able to switch suppliers than ever 

Increased willingness of governments to intervene in business on issues 
of public concern 

Customers' increased focus on buying from ethical suppliers 
Increased targeting of companies by pressure groups 
Other 


To what extent are the following actions a source of reputational 
risk for your organisation? 

(% respondents) 


Majo 


Non-compliance with regulation/legal obligations 


Exposure of unethical practices 


Security breaches (eg, sensitive data leaks, hacking of customer financial data) 


El 


Failure to deliver minimum standards of service and product quality to customers 


WSM 


Poor crisis management 


Failure to hit financial performance targets 


Risk by association with suppliers, partners, alliances, etc with poor reputations 


Failure to address issues of public concern pro-actively (eg, climate change) 


FT1 


Environmental breaches 


Other 

■Ln 
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How much damage have the following events inflicted on your company's financial performance in the past? 

(% respondents) 

Major Minor 

Loss of reputation 

Non/negligible 

Loss of key skills and talent 




Employee fraud 




Loss/theft of intellectual property 




IT failures or electronic security breaches 




Damage to physical infrastructure 





Which of the following activities does your organisation take to manage reputational risk? 

Please check all that apply. ™ More than US$10bn revenues 

(% respondents) Less than USJlObn revenues 

Less than US$lbn revenues 


Processes for crisis management are planned and documented 



The risk function's remit now covers key reputational threats and challenges 



Standards on environmental, human rights and labour practices are set publically 


( 8 ) 22 


Relationships and trust with pressure groups and other potential critics of your firm are established 
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How often do you test perceptions of your company among the following corporate stakeholders? 

(% respondents) 


Continuously 


At leastonce 
a month 


At least four 
times a year 


Once a year 


Only occasionally Never 
in the past 


Regulators 


m 


Media groups 
Government 
Local non-governmental organisations 
Political activists/pressure groups 


International non-governmental organisations 



Who is primarily responsible for the following activities? 

(% respondents) 


Quantifying threats to reputation 


Communications 
role (eg, PR, 
marketing) 



il BH 

Ensuring controls are systematically enforced 



Developing strategy on reputational risk 



Crisis management and repairing damage once done 


Ensuring effective co-ordination between different functions 


Eyes and ears of the company on reputational threats 
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Do you agree or disagree with the following statements? 

(% respondents) 

Corporate reputation is one of the primary assets of my firm 


The risks involving an organisation's reputation have increased significantly overthe past five years 


Reputational risk is harder to manage than other forms of risk 


My firm is proactive in enhancing and protecting its reputation 


It is impossible to quantify the impact of reputational risks 


Our programme for corporate social responsibility is reputational risk management by another name 
My firm usually thinks about its reputation only when things go wrong 


A well-run business doesn t need to invest extra resources into guarding against reputational risk 


Agree 


Disagree 


m 


Which of the following have major responsibility for managing 
reputational risk within your company? 

Please check as many as apply. 

(% respondents) 


CEO/President/Chairman 


ED 


Board of directors 


ED 


Chief risk officer (CR0)/Head of risk management 
Head of business units 


Communications manager 


Compliance officer 


M3 

El 


El 


Chief operating officer 
Marketing manager 
Head of country operations 
Brand manager 


Media agency 



How would you rate each of the following as an obstacle to 
managing reputational risk in your organisation? 

(% respondents, major obstacle) 


Lack of established tools and techniques to manage reputational risk 


No one has taken formal responsibility for reputational risk 


m 


Poor co-ordination between the board, risk function, corporate communications, etc 


Poor communications with external stakeholders 
Too many reputational threats to manage 

Management is too internally focused/unaware of external perceptions 
Weak governance/internal controls 
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How would you rate your company's capabilities in the following areas? 

(% respondents) 


Communicating with customers 


Enforcing strong controls on governance and compliance 


Monitoring threats to reputation 


Ensuring ethical practices throughout the supply chain 


EH 


Communicating with external stakeholders (other than customers) 


Crisis management 


Adequate Poor 
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verify the accuracy of this information, 
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liability for reliance by any person on 
this white paper or any of the 
information, opinions or conclusions 
setoutin the executive survey. 
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